﻿namespace HelperLibrary;

public static class SQLInjectHelper
{
    private const string FilterSql = "execute,exec,select,insert,update,delete,create,drop,alter,exists,table,sysobjects,truncate,union,and,or,order,xor,mid,cast,where,xp_cmdshell,join,declare,nvarchar,varchar,char,sp_oacreate,wscript.shell,xp_regwrite,',%,;,--";
    /// <summary>
    /// 过滤sql标记
    /// </summary>
    /// <param name="inputValue"></param>
    /// <returns></returns>
    public static string SQLFilter(string inputValue,out bool isExist)
    {
        isExist = false;
        var filters = FilterSql.Split(',');
        foreach(var filter in filters)
        {
            if (inputValue == filter)
            {
                isExist = true;
                break;
            }
        }
        //inputValue = filters.Aggregate(inputValue, (current, filterSql) => Regex.Replace(current, filterSql, "", RegexOptions.IgnoreCase));
        return inputValue;
    }
}
